# Apps and keys

An app is your bot or website as dzbot sees it. It holds everything that bot uses — its API keys, its Sign in with dzbot and its webhooks. Delete the app and all of it stops working at once.

## Create an app

In your server's admin area, open **Developers** and create an app with a name (players see it when they sign in). An app belongs to your organization; enable it for the servers it works on.

| Part | For |
| --- | --- |
| **Rights ceiling** | The access rights the app may ever use, wildcards included (`player.*`, `admin.tickets.*`). No key, token or webhook of the app gets past it |
| **Keys** | Server-to-server access for your bot or backend, one server each — see below |
| **Sign in with dzbot** | Redirect URIs, browser origins and the client secret — see [Sign in with dzbot](https://developers.dzbot.de/sdk/oauth) |
| **Webhooks** | Endpoints that receive events — see [Webhooks](https://developers.dzbot.de/sdk/webhooks) |

Managing apps takes the `admin.developers.*` rights. Apps work while the server is on dzbot Pro; on dzbot Free their keys and tokens are refused and their webhooks stop.

## API keys

A key starts with `dzk_` and is shown once — copy it when you create it, keep it out of code and public channels, and delete it to revoke it at once. A key belongs to one server and carries its own access rights inside the app's ceiling. On a server with ticket **support levels** it also needs the matching `admin.tickets.level_<id>` right to see tickets.

```
curl "https://api.dzbot.de/api/developer/me" \
  -H "Authorization: Bearer dzk_your_key_here" \
  -H "X-Server-Subdomain: your-server"
```

Keys are secrets: use them on a server only. For a website that calls dzbot from the browser, use [Sign in with dzbot](https://developers.dzbot.de/sdk/oauth) with a public client.

## Rate limits

| Limit | Requests |
| --- | --- |
| Per key or per signed-in token | 120 per minute |
| Per app, all its keys and tokens together | 600 per minute |

Over the limit, the API answers `429` with `Retry-After` in seconds. Use [webhooks](https://developers.dzbot.de/sdk/webhooks) or [live events](https://developers.dzbot.de/sdk/live) instead of polling; for data without an event, once a minute is plenty.

---

Web page: https://developers.dzbot.de/api/apps · All pages: https://developers.dzbot.de/llms.txt